/usr/share/mobile-broadband-provider-info/serviceproviders.xml - The list of all service providers supported by Chromium OS, with their APN info. AT&T's is listed and correct (unless you're on the iPhone data plan).

So, how far did I get? So close.

modem status to get the path for the modem. replace # below.

modem factory-reset /org/chromium/ModemManager/Gobi/# 000000

modem_set_carrier "AT&T"

modem status

At this point, I see lots of good things. My AT&T SIM's cell phone number is listed as my MDN. The modem is set up to use UMTS, and claims to have signal.

The problem is activation. It looks like we need to use org.freedesktop.ModemManager.Modem.Simple.Connect. The problem is, this command takes a mixed array ({string,variant}) -- which can't be created using any of the provided command line tools.
In the method documentation for "ActivateManualDebug" in Google's spec "mm-modem-cdma.xml", they make note of this bug. ("Workaround for the fact that dbus-send cannot send dictionaries of variants. Calls ActivateManual, with system_id converted to int.")

So, given the limited information I have, it looks like we can't activate an UMTS connection without writing our own (C++/Python) D-Bus interface to facilitate activation. I'm a newb with all of this D-Bus nonsense, so take my conclusion with a grain of salt. But this is where I gave up.